Facebook takedown followup: what happened, and what Facebook needs to fix

The Ars Facebook page has made its triumphant return to the Internet, but …

Facebook has reinstated a number of sites' Facebook pages that were taken down due to bogus copyright claims this week. The company issued an apology for the inconvenience and says that DMCA notice abuse is an issue that Facebook takes seriously, but serious questions still remain about the effectiveness of Facebook's process for dealing with complaints.

"We have invested significant resources into creating a dedicated team that uses specialized tools, systems and technology to review and properly handle intellectual property notices. This system evaluates a number of factors when deciding how to respond and, in many cases, we require the reporter to provide additional information before we can take action. As a result of these efforts, the vast majority of intellectual property notices that we receive are handled without incident," Facebook spokesperson Brooke Oberwetter told Ars on Thursday evening.

"Of course, no system is perfect and we are always striving to improve our practices. As such, we will be considering the results of our investigation into this matter as we continue to refine our systems and procedures."

What the heck happened?

Ars found out about Facebook's DMCA takedown system the hard way on Wednesday evening when our Facebook page (now back up) mysteriously disappeared from Facebook's system. It turns out that a copyright infringement notice was filed against us—as well as a number of other sites, including Neowin and Redmond Pie—through Facebook, resulting in the automatic disappearance of our entire Facebook page and all the content on it. We, like many other news sites and blogs, make use of Facebook to share our own content and interact with readers, and it's one of our most popular referrers back to the site. The disappearance of our page and some 40,000 fans, with scant explanation and no clear way to appeal, was disconcerting to say the least.

After we reported on the takedown, stories began flooding in from individuals who had suffered a similar fate. A reader by the name of Mark Weikert told one of the most heartbreaking stories—he's a professional photographer who used Facebook to get exposure and increase the reach of his business, which was proving to be an effective tactic until his account was disabled due to an abusive claim. "And thus, my fan page was automatically assigned to some random 'fan' of the page. Of course they renamed it and stole all of my fans," Weikert told us via e-mail. "When contacting Facebook to try and get my main account reinstated and my fan page back, (7 total e-mails spanning a 2 week time) I got no response at all. My network had been crushed and I had to start from scratch."

Another reader and musician named Hassan from ApniISP, a popular site dedicated to Indian and Pakistani music, wrote in to tell us that his Facebook page with 44,000+ fans (more than Ars!) was disabled at the beginning of March due to a fake copyright complaint. "I am still fighting for my rights and trying to get it back," Hassan told us, but Facebook apparently told him to contact the complaining party to get the issue resolved. "The e-mail address they have provided me is not even working now," he said, adding that it bounces back all his e-mails. Hassan's issue remains unresolved.

Malicious individuals sure have an easy time taking down some popular Facebook fan pages, but sometimes it goes further than the lulz. ReadWriteWeb recounted a story from Hamad Dar's Rewriting Technology site, who had its Facebook page taken down over fake copyright claims, only to be threatened later with extortion by the party who submitted the claim. "He wanted me to pay him...to get the page back," Dar said.

Facebook's problematic reactions

Attorneys Ars spoke with told us that Facebook seems to handle the DMCA takedown process in accordance with US law—for the most part. There are a number of things Facebook needs to fix, however. Let's start with the vague notifications and slow responses: in nearly all cases, Facebook did not specify which content was supposedly infringing before taking down the entire page. According to Condé Nast's crack legal team, a proper DMCA takedown is supposed to specify the infringing material, and that content is supposed to be removed immediately until a counterclaim is filed. Facebook did not do this—instead, it claimed "Ars Technica" was the infringing material, and subsequently removed our entire page.

Facebook also did not tell us who filed the claim until moments before the publication of this article—not technically required for the DMCA process, but providing the name of the claimant is industry-wide best practice. So, Ars has only within the past couple of hours found out who filed the bogus complaint against us, and we still don't know why or for which content. (We're hoping to follow up with this person, assuming he's real, in order to find out his motivation for filing the takedown notice.)

Several other sites, such as Neowin, did manage to get the contact information for the person who allegedly filed their complaints, but in Neowin's case, that contact information ended up being falsified. This is a problem, because in some cases, Facebook has been telling "victims" that they must resolve the case with their complainant in order to get their Facebook pages back. How is someone supposed to resolve the issue if the person who filed the complaint listed fake contact info?

No e-mail verification

There's nothing in the DMCA that says Facebook absolutely must confirm the identity of the party filing the complaint. However, the way Facebook handles some of its complaints—by putting the victim in touch with the complainant—means that its current system is broken. How so? Because anybody could file a complaint against any site for any reason, and do so with fake contact info.

Some basic e-mail validation would help cut down abusive complaints significantly. All it would take would be an e-mail sent to the address in question with a verification link to complete the DMCA claim, similar to what many sites do when you register a new account. If the e-mail address is nonexistent, the verification would bounce and the claim could be put into manual review for legitimacy. If the e-mail address belongs to someone else, that party could ignore the message altogether or confirm that it wasn't them who submitted it, allowing Facebook to flag the claim as incomplete or fake. If it's real and the e-mail recipient confirms that he or she submitted the claim, Facebook could move forward with a takedown of the content in question.

Of course, e-mail validation like this won't help people like Hamard Dar, whose page was taken down by an extortionist. It would, however, cut down on what seems like a significant problem with anonymous and abusive DMCA takedown notices. We continue to hear stories about this happening to "little" and big guys alike, but Facebook would not confirm to us whether this is truly a common problem or not.

What else can be done?

Facebook also refused to answer questions about how often it gets hit with bogus claims, what happens internally when a complaint comes in, if a real person reviews counterclaims sent to Facebook's intellectual property team, and how long the process normally takes to get a Facebook page back up. (Our situation lasted about 24 hours from start to finish, but it was only resolved that quickly with the help of a major PR blast on our part and lots of Internet coverage.)

Those questions all remain unanswered, though we are told that Facebook is reviewing its current practices after this week's events and will consider changes as appropriate.

Facebook also declined to give us recommendations on how to avoid this situation in the future, or at the very least, how to better handle it to ensure incorrectly taken-down content is restored quickly. So until Facebook manages to tweak its policies—if that ever happens—Facebook page admins will continue to be faced with frustrating, vague, and fake DMCA takedowns sent through Facebook's system. We plan to continue pressing Facebook on this issue, but in the meantime, keep sending in your horror stories. We're sure there are plenty more out there.

Update 4/30/2011: Hamad Dar and Redmond Pie's Taimur Asad both contacted us directly on Friday evening to help clarify some points we weren't clear on with this situation thanks to Facebook's unwillingness to answer our questions. There are two types of takedowns: content takedowns (copyright) and entire page takedowns (intellectual property/brand ownership), and they depend entirely on what the complaining party claims is his or her work. The complaining party can, in fact, claim that an entire site belongs to them—this is apparently what happened to us and a number of other sites, leading to the removal of our entire pages.

Asad suggests that Facebook implement some sort of identity validation procedure when you start new Facebook Pages, similar to Twitter's verification system for celebrities and important parties. This would help cut down on incidents of fake ownership claims such as the ones that hit us this week.

They should hide the exact infringing material, etc. At a minimum if they have to take down a whole profile they need to do so in a way that hides it but doesn't purge it from the system or otherwise allow someone else to grab fans away, etc.

Do you guys know who filed for the takedown yet? Or was it really just an anonymous source that can't be tracked back to its origination?

fta:

Quote:

Ars has only within the past couple of hours found out who filed the bogus complaint against us, and we still don't know why or for which content. (We're hoping to follow up with this person, assuming he's real, in order to find out his motivation for filing the takedown notice.)

They know who it is but haven't verified that this person is actually at the other end of the email address, reading and replying to messages.

As far as on can tell Facebook have designed a system to make it impossible for Targets of takedowns to appeal their case. The make it near impossible to find out what is the infringing material and who the complainant is. The don't want to get in the middle of the dispute and do that by preventing the target of the complaint from interacting with Facebook. The callous disregard for appropriate due process highlight the fact that Facebook don't care about their customers only about getting and sharing the customer private information with companies that can pay Facebook handsomely for that info. Whether we like it or not we are merely a revenue stream for Facebook and having us stand up to complain just gets in the way of us being only that. Like it or not our private data IS a saleable and tradeable commodity these days and god forbid that anything should come along to get in the way of that business...

My solution to this problem has been, and continues to be, not to use Facebook.

In our continuing saga...

Ars does take the advice of Elipsis and decides to set up shop on another popular social media site. Everything gets set up, and accounts start flowing in. Soon, the site is removed because another bogus DMCA notice was sent.

Deterred, but not dead, Ars tries another site and the results follow as well.

After about 6 sites, Ars has had enough and bans Elipsis while returning back to Facebook under the new account Ars Technica Lives (and let's hope this time, we can stay).

The DMCA is broken. It was broken before it was turned into law.

And you, Elipsis, probably contributed to the law's passing by purchasing a movie at some point in your lifetime.

So this means I can take down Apple's or Microsoft's or Google's or IBM's Facebook pages by just sending an e-mail to Facebook. Wow. Social engineering at its easiest. Who needs viruses and trojans anymore when all you need to do is send a specially-worded e-mail. Heck, you can even program a bot to do the entire thing for you. Something like the equivalent of 'cat allFacebookPages.txt | while read PAGE; do sendFacebookComplainForPage.sh $PAGE; done'. And that'll effectively take down all of Facebook, too, since there'll be nothing left. Facebook is dumb.

Welcome to the digital service jungle. Google Places took down my business because they changed their address policy back in December! There was no direct recourse except to scour their rules, figure out what they didn't like, change it and resubmit. I received a phone call from Google a month ago, out of the blue, saying they were about to put my business back up. Still nothing, and no one to contact. The future in short.

I seriously don't understand why you need a Facebook page anyway. You guys have a very successful site, that gets a lot of traffic on it's own. What exactly does Facebook give you that you don't already have? My wife got a Facebook account a year or so ago because her high school reunion was evidently being co-ordinated through it. Neither of us had one before then. I really don't get the attraction for people. My younger brother is addicted to the site, but seriously, he's an idiot. I also really hate that more and more often I see sites referring to content or access in some way only through Facebook. It's becoming a walled garden on the internet like AOL used to be.

Apparently Facebook never implemented the counter-notice functionality when they built their DMCA notice system.

IANAL.

Send a paper copy certified mail. They've got 10 days from receipt to restore or for you to be sued in court by the complaintant. I mean, it's not quick, but it's got to be faster than starting over. If they ignore it, they could lose DMCA protection and would be liable for damages.

It's really clear that Facebook isn't going to change a damn thing until they're forced to. They don't even seem to be embarrassed at being played for the fool in taking down these pages, even after all the (bad) press in the last day. They just don't seem to CARE at all about this.

PetrifiedJello, but why? Why keep at it with the social media sites? I complete agree that the DMCA is broken, but as charleski agreed, why are we giving such incredible business-ruining type power to sites with zero vested interest in the well being of the businesses relying on it?

Hit up a registrar and build your own site. If it gets popular enough that you can't swing the bandwidth on your own line put some of that money into professional hosting. Build your own community... a forum, something to bring people to *your* site and not a shitty facebook page.

My solution to this problem has been, and continues to be, not to use Facebook.

++

And as the tale of Mark Weikert shows, under no circumstances should you allow your business to become dependent on such a bunch of flakes.

Well, on a personal level I agree with this 100%, I have absolutely no use for Facebook at all. However, from a business and marketing perspective, FB and other sites like it are something that you just have to do. You may not like it, but it is an extremely powerful tool for targeted marketing and any business that ignores it is simply foolish. You wouldn't put up a billboard in Antarctica just because you like it better than Florida, the same is true of FB.

Elipsis wrote:

PetrifiedJello, but why? Why keep at it with the social media sites? I complete agree that the DMCA is broken, but as charleski agreed, why are we giving such incredible business-ruining type power to sites with zero vested interest in the well being of the businesses relying on it?

Hit up a registrar and build your own site. If it gets popular enough that you can't swing the bandwidth on your own line put some of that money into professional hosting. Build your own community... a forum, something to bring people to *your* site and not a shitty facebook page.

You are missing the point entirely. Yes, your own website would be far more flexible than a FB page. The point is you have to go where the people are, and FB will allow just about anyone with a compelling product/idea/service to very quickly get noticed. FB is a great marketing tool to drive people to your site, and has an engaged captive audience. That is simply something you can't get from SEO and google search results.

So far, the following systems have failed email verification, why should Facebook be different

1) Chase Credit Cards [and probably others]2) XBox Live3) PSN

I have random people using all of the 3 above items incorrectly where a simple email verification would have solved the problem. I've tried with no success to have the XBox Live and PSN accounts cancelled by using my email address, and I've tried contacting the Chase fraud detection center as well. NONE of the above companies have responded in a reasonable fashion to my requests to terminate the accounts or disassociate my email address with them.

So... why is this so hard? If someone types in their email address to your system, simply send them a confirmation message to that account so they can verify they actually own it. It's NOT that hard, it SHOULD be standard practice.

Is it just me, or is Ars missing the most blindingly obvious failure on Facebook's part? The failure to include any provision for DMCA counter-notices, AS THE LAW REQUIRES. It seems to me that Facebook is most definitely NOT in compliance with the process outlined in the DMCA, since that requires people whose content is taken down to have the ability to submit a counter-notice and get their content restored within 10-14 business days. If what Ars is reporting is true, not only does Facebook not provide any avenue for submitting counter-notices, they require you to contact the claimant directly and persuade them to retract their claim before they will restore the content, which is most certainly NOT what the law says. Please tell me if I'm missing something, but it seems to me Facebook is only following HALF of the DMCA, adopting the part where content gets taken down quite readily, but leaving out the part where content gets put back up.

I seriously don't understand why you need a Facebook page anyway. You guys have a very successful site, that gets a lot of traffic on it's own. What exactly does Facebook give you that you don't already have? My wife got a Facebook account a year or so ago because her high school reunion was evidently being co-ordinated through it. Neither of us had one before then. I really don't get the attraction for people. My younger brother is addicted to the site, but seriously, he's an idiot. I also really hate that more and more often I see sites referring to content or access in some way only through Facebook. It's becoming a walled garden on the internet like AOL used to be.

And I believe you're underestimating the power of social networking sites. Just because you don't "get it" doesn't mean it isn't powerful. I'll grant you, there are some problems with FB, as this whole thing clearly illustrates. However, the web of interconnectedness provided by FB and its brethren (Twitter, Google Buzz, etc) is of amazing value when you want to both keep informed and disseminate information.

severusx, sure. I get your point about Facebook being where the people are (and that's a damn shame), but if you give people no incentive to visit your own site regularly and exist *just* as a facebook entity... you're setting yourself up for this kind of disaster.

The Ars site, for example, is well maintained and certainly provides far and away more content than its facebook page does. (I didn't know Ars had a facebook page until these stories hit... like many users I just browse here.)